OTPulse

Mitsubishi Electric CC-Link IE TSN Communication Protocol

MonitorCVSS 7.1ICS-CERT ICSA-26-211-07Jul 30, 2026
Mitsubishi ElectricEnergyManufacturing
Attack path
Attack VectorAdjacent
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary

A weakness in the CC-Link IE TSN communication protocol allows an attacker on the same network segment to intercept and modify communication packets under specific timing conditions. By sending specially crafted packets, an attacker can tamper with data exchanged between controllers and remote I/O modules, causing denial-of-service conditions or incorrect device operation. The vulnerability affects 90+ Mitsubishi Electric products spanning controllers, motion modules, inverters, servos, I/O modules, and industrial computers—all versions, with no firmware patches available. Mitsubishi Electric has stated these products will not receive security updates.

What this means
What could happen
An attacker on the same network segment can intercept and modify CC-Link IE TSN communication packets to disrupt controller operations, causing devices to malfunction, stop responding, or execute unintended commands.
Who's at risk
Energy and manufacturing customers using Mitsubishi Electric CC-Link IE TSN controllers and distributed I/O modules should care. This affects a wide range of products: MELSEC MX controllers (MX-R and MX-F series), motion controllers (RD78 series, MR-EM441G), AC servos (MELSERVO-J5 and MELSERVO-JET), inverters (FR-A800/F800/E800 series), industrial robots (CR800-D), operator panels (GOT3000 series), and various I/O and communication modules. The vulnerability threatens any facility using CC-Link IE TSN for real-time process control or safety functions.
How it could be exploited
An attacker with access to the same physical network segment (local LAN or CC-Link IE TSN network) sends specially crafted packets with precise timing to intercept and modify communication between controllers and connected devices. The attacker does not need to authenticate or compromise any device directly; they only need network visibility of the CC-Link IE TSN traffic.
Prerequisites
  • Network access to the same CC-Link IE TSN segment as affected devices
  • Ability to send Ethernet frames at precise timing windows
  • No credentials or authentication required
No patch available (all affected products end-of-life)Affects safety-rated remote modules (NZ2GNSS2 series)Remotely exploitable over EthernetNo authentication requiredLow attack complexityTampering with industrial automation networks
Exploitability
Unlikely to be exploited — EPSS score 0.1%
Affected products (115)
115 EOL
ProductAffected VersionsFix Status
MELSEC MX Controller MX-R model MXR300-16All versionsNo fix (EOL)
MELSEC MX Controller MX-R model MXR300-32All versionsNo fix (EOL)
MELSEC MX Controller MX-R model MXR300-64All versionsNo fix (EOL)
MELSEC MX Controller MX-R model MXR500-128All versionsNo fix (EOL)
MELSEC MX Controller MX-R model MXR500-256All versionsNo fix (EOL)
Remediation & Mitigation
0/5
Do now
0/2
HARDENINGRestrict physical network access to CC-Link IE TSN cables and Ethernet ports using locked cabinets, cable ducts, or port lock accessories
HARDENINGInstall a firewall or network boundary device to block all communication between the CC-Link IE TSN network and untrusted external networks
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HARDENINGReview and restrict network credentials and access privileges on any boundary devices (firewalls, routers, switches) between trusted and external networks
Mitigations - no patch available
0/2
The following products have reached End of Life with no planned fix: MELSEC MX Controller MX-R model MXR300-16, MELSEC MX Controller MX-R model MXR300-32, MELSEC MX Controller MX-R model MXR300-64, MELSEC MX Controller MX-R model MXR500-128, MELSEC MX Controller MX-R model MXR500-256, MELSEC MX Controller MX-F model MXF100-8-N32, MELSEC MX Controller MX-F model MXF100-8-P32, MELSEC MX Controller MX-F model MXF100-16-N32, MELSEC MX Controller MX-F model MXF100-16-P32, Master/local module RJ71GN11-T2, Master/local module RJ71GN11-SX, Master/local module RJ71GN11-EIP, Master/local module FX5-CCLGN-MS, CC-Link IE TSN interface board NZ81GN11-SX, CC-Link IE TSN interface board NZ81GN11-T2, Motion module RD78G4, Motion module RD78G8, Motion module RD78G16, Motion module RD78G64, Motion module RD78GHV, Motion module RD78GHW, Motion module FX5-40SSC-G, Motion module FX5-80SSC-G, Motion Control Board MR-EM441G, Block-type remote module NZ2GN2S1-32D, Block-type remote module NZ2GN2S1-32T, Block-type remote module NZ2GN2S1-32TE, Block-type remote module NZ2GN2S1-32DT, Block-type remote module NZ2GN2S1-32DTE, Block-type remote module NZ2GN2B1-32D, Block-type remote module NZ2GN2B1-32T, Block-type remote module NZ2GN2B1-32TE, Block-type remote module NZ2GN2B1-32DT, Block-type remote module NZ2GN2B1-32DTE, Block-type remote module NZ2GNCF1-32D, Block-type remote module NZ2GNCF1-32T, Block-type remote module NZ2GNCE3-32D, Block-type remote module NZ2GNCE3-32DT, Block-type remote module NZ2GN12A4-16D, Block-type remote module NZ2GN12A4-16DE, Block-type remote module NZ2GN12A2-16T, Block-type remote module NZ2GN12A2-16TE, Block-type remote module NZ2GN12A42-16DT, Block-type remote module NZ2GN12A42-16DTE, Block-type remote module NZ2GN2S1-16D, Block-type remote module NZ2GN2S1-16T, Block-type remote module NZ2GN2S1-16TE, Block-type remote module NZ2GN2B1-16D, Block-type remote module NZ2GN2B1-16T, Block-type remote module NZ2GN2B1-16TE, Block-type remote module with safety functions NZ2GNSS2-8D, Block-type remote module with safety functions NZ2GNSS2-8D-K, Block-type remote module with safety functions NZ2GNSS2-8TE, Block-type remote module with safety functions NZ2GNSS2-8TE-K, Block-type remote module with safety functions NZ2GNSS2-16DTE, Block-type remote module with safety functions NZ2GNSS2-16DTE-K, Block-type remote module with safety functions NZ2GNS12A2-14DT, Block-type remote module with safety functions NZ2GNS12A2-16DTE, Analog-Digital converter module NZ2GN2S-60AD4, Analog-Digital converter module NZ2GN2B-60AD4, Digital-Analog converter module NZ2GN2S-60DA4, Digital-Analog converter module NZ2GN2B-60DA4, CC-Link IE TSN compatible coupler NZ2FT-GN, FPGA module NZ2GN2S-D41P01, FPGA module NZ2GN2S-D41D01, FPGA module NZ2GN2S-D41PD02, Tension meter LM7-1LG, Tension meter LM7-2LG, AC Servo MELSERVO-J5 MR-J5-G, AC Servo MELSERVO-J5 MR-J5W-G, AC Servo MELSERVO-J5 MR-J5-G-HS, AC Servo MELSERVO-J5 MR-J5-G-RJ, AC Servo MELSERVO-J5 MR-J5-G-LL, AC Servo MELSERVO-J5 MR-J5D-G4, AC Servo MELSERVO-J5 MR-MD333G, AC Servo MELSERVO-JET MR-JET-G, AC Servo MELSERVO-JET MR-JET-G4-HS, Inverter FR-A800/F800/E800 Series FR-A8NCG, Inverter FR-A800/F800/E800 Series FR-A8NCG-S, Inverter FR-A800/F800/E800 Series FR-A800-GN, Inverter FR-A800/F800/E800 Series FR-E800-E, Inverter FR-A800/F800/E800 Series FR-E800-SCE, Industrial Robot CR800-D series controller Network Base Card 2F-DQ535-TSN, CC-Link IE TSN expansion unit FCU8-EX569, CC-Link IE TSN-CC-Link IE Field Network bridge module NZ2GN-GFB, CC-Link IE TSN-AnyWireASLINK bridge module NZ2AW1GNAL, Energy Measuring Unit CC-Link IE TSN Communication Unit EMU4-CM-TSN, Industrial Computer MELIPC series MI2532-W, Industrial Computer MELIPC series MI2332-W, GOT3000 Series GT3715-FHCBD, GOT3000 Series GT3712-WXCBD, GOT3000 Series GT3715-XRBA, GOT3000 Series GT3715-XRBD, GOT3000 Series GT3712-XRBA, GOT3000 Series GT3712-XRBD, GOT3000 Series GT3710-XRBA, GOT3000 Series GT3710-XRBD, GOT3000 Series GT3708-XRBA, GOT3000 Series GT3708-XRBD, CC-Link IE TSN Communication Unit GT25-J71GN13-T2, Motion Control Software SWM-G, Motion Control Software SWM-G-N1, CC-Link IE TSN Communication Software for Windows SW1DND-CCIETCT-M, Master/Local module Designated communication LSI DeviceKit NZ2KT-NPETNG51, Master/Local module Designated communication LSI NZ2GACP610-60, Remote Station Communication LSI with GbE-PHY NZ2GACP620-60, Remote Station Communication LSI with GbE-PHY NZ2GACP620-300, Remote Station Communication LSI with GbE-PHY NZ2GACP621-90, Remote Station Communication LSI with GbE-PHY NZ2GACP621-720, CC-Link IE TSN Master/Local module Designated communication LSI SDK SW1DNN-GN610SRC-M, Remote station software development kit SW1DNC-GNSDK1S-M, Remote station software development kit SW1DNC-GNSDK2S-M, Liner Track System MTR-S series Linear track control module MTR-SCU00-4G, Liner Track System MTR-S series Linear track control module MTR-SCU00-PG, Analysis Support Software MELSOFT VIMA SW1DNN-VIMA-M. Apply the following compensating controls:
HARDENINGIsolate the CC-Link IE TSN network as a separate trusted network segment; do not allow devices from the corporate network or internet to communicate with it
HARDENINGControl physical access to sites where affected controllers and network devices are installed (e.g., badge access, visitor logs, locked machine rooms)
View full CISA ICS-CERT advisory
API: /api/v1/advisories/6228034e-4e62-4d4c-8aeb-32d0f1824f38

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.